Staff Security Engineer - AppSec

6sense

1d•$200,947 - $255,722•Remote

About The Position

As a member of 6sense’s Security department, the Staff Security Engineer works with engineering teams, product managers, and third parties to help secure 6sense SaaS products and protect the platform. The role provides application security expertise, mentorship, and guidance to Security Engineers and partners across engineering and product teams. It also leads security reviews, threat modeling, automated testing, developer training, and cross-functional initiatives to improve and scale application security. The role includes managing vulnerabilities through remediation or risk acceptance within targeted SLAs, maintaining security scope inventories and up-to-date collateral, metrics, and processes, and implementing effective security controls in response to current threats, trends, and best practices. The engineer is expected to understand the 6sense product and platform at an expert level, identify security gaps, drive improvements, and design and execute quarterly (O)KRs. The position reports to the Manager, Security Engineering.

Requirements

At least 8 years of information security experience, focused on application security, including threat modeling, developer training, vulnerability management, automated security testing, and code reviews.
Expert understanding of common security flaws and how to remediate them, including the OWASP Top 10.
Expert understanding of network and web protocols such as TCP/IP, UDP, HTTP, and HTTPS.
Some development or scripting experience and skills in Python or JavaScript.
Excellent written and verbal communication skills, including the ability to explain complex topics clearly and concisely.
Experience working directly with software developers to improve code security.
Expert understanding and practical experience with common security libraries, security controls, and security flaws.
Experience with security tools such as vulnerability scanners, SAST/DAST, DevOps software, and AWS cloud security tooling.
Strong knowledge of industry frameworks, regulations, and standards such as NIST 800-218 SSDF, OWASP, SAFECode, CIS benchmarks, ISO 27001, SOC 2, GDPR, PCI, SOX, and NIST 800-53.
Ability to work independently and manage multiple projects simultaneously.
Ability to influence and collaborate with cross-functional teams.
Ability to translate technical requirements into actionable, time-bound requests.
Ability to drive projects and tasks to completion by following up on questions, deadlines, and requests for input.
Ability to prioritize and escalate rapidly and effectively, and maintain information accuracy.

Nice To Haves

Bachelor's degree in a related field.
Relevant industry certifications, such as AWS, CNCF, or GIAC.

Responsibilities

Mentor and support other Security Engineers, and assist with Senior-level responsibilities when needed.
Support and consult with engineering and product teams on application security vulnerabilities.
Help teams reproduce, triage, and address vulnerabilities found through penetration testing, SAST, DAST, or dependency scans.
Drive changes to the bug bounty program to position it as an industry-leading security program.
Lead development of automated security testing that validates secure coding practices.
Lead application security reviews and threat modeling, including code review and dynamic testing.
Lead and influence cross-functional changes across the Security organization.
Own and promote security training with development teams.
Drive initiatives that scale application security and address multiple vulnerabilities within functional areas.
Design and execute quarterly (O)KRs.
Identify security gaps and drive changes that improve the security posture.
Implement security controls informed by current threats, trends, and best practices.
Manage vulnerabilities through remediation within targeted SLAs or risk acceptance.
Maintain an inventory of security scope for 6sense products.
Maintain current collateral, metrics, and processes.
Understand the 6sense product and platform at an expert level.
Participate in weekly 1:1 meetings with the manager and monthly skip-level meetings.

Benefits

Health insurance and health coverage.
Life insurance.
Disability insurance.
401(k) employer matching.
Paid holidays.
Paid time off (PTO).
Paid parental leave.
Quarterly self-care days off.
Stock options.
Equipment and support for working and connecting with teams at home or in an office.
Access to LinkedIn Learning and other learning and development initiatives.
Quarterly wellness education sessions.
Wellness days and ERG-hosted events.